CVE-2024-43690

State: Published
Severity: 8.0 High
Published: Sep 11, 2024
Updated: Sep 11, 2024
Reserved: Aug 28, 2024

Description

Inclusion of Functionality from Untrusted Control Sphere(CWE-829) in the Command Centre Server and Workstations may allow an attacker to perform Remote Code Execution (RCE).

This issue affects: Command Centre Server and Command Centre Workstations 9.10 prior to vEL9.10.1530 (MR2), 9.00 prior to vEL9.00.2168 (MR4), 8.90 prior to vEL8.90.2155 (MR5), 8.80 prior to vEL8.80.1938 (MR6), all versions of 8.70 and prior.

Scores

CVSS	Score	Vector	Source
3.1	8.0 High	CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H	Gallagher

Weaknesses

CWE-829 Inclusion of Functionality from Untrusted Control Sphere

Affected Products

Product	Versions
Command Centre ServerGallagher	8.70 and earlierAffected 9.10 to before vEL9.10.1530(MR2)Affected 9.00 to before vEL9.00.2168 (MR4)Affected 8.90 to before vEL8.90.2155 (MR5)Affected 8.80 to before vEL8.80.1938 (MR6)Affected

References

https://security.gallagher.com/en-NZ/Security-Advisories/CVE-2024-43690

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.